Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

server/web/src/components/Fleet/FleetToolbar.tsx

@@ -9,6 +9,8 @@ interface Props {
   onChange: (next: FleetFilterState) => void;
   selectedCount: number;
   onBulkAction: (action: string) => void;
+  onSelectAllFiltered?: () => void;
+  filteredCount?: number;
   bulkBusy: boolean;
 }
 
@@ -18,6 +20,8 @@ export default function FleetToolbar({
   onChange,
   selectedCount,
   onBulkAction,
+  onSelectAllFiltered,
+  filteredCount,
   bulkBusy,
 }: Props) {
   const tags = collectFleetTags(agents);
@@ -78,6 +82,14 @@ export default function FleetToolbar({
         </label>
       </div>
 
+      {onSelectAllFiltered && (filteredCount ?? 0) > 0 && selectedCount === 0 && (
+        <div className="fleet-bulk-bar">
+          <button type="button" className="btn btn-outline btn-sm" onClick={onSelectAllFiltered}>
+            Select all filtered ({filteredCount})
+          </button>
+        </div>
+      )}
+
       {selectedCount > 0 && (
         <div className="fleet-bulk-bar">
           <span className="font-tech">{selectedCount} selected</span>

server/web/src/components/SessionGate.tsx

@@ -11,6 +11,7 @@ export default function SessionGate({ children }: { children: ReactNode }) {
   useEffect(() => {
     const token = getStoredAuth();
     if (!token) {
+      setAuthed(false);
       setReady(true);
       return;
     }
@@ -19,20 +20,27 @@ export default function SessionGate({ children }: { children: ReactNode }) {
         setAuthed(r.ok);
         setReady(true);
       })
-      .catch(() => setReady(true));
+      .catch(() => {
+        setAuthed(false);
+        setReady(true);
+      });
   }, []);
 
   const handleLogin = async (e: React.FormEvent) => {
     e.preventDefault();
     setErr('');
     const token = btoa(`${user}:${pass}`);
-    const res = await fetch('/api/v1/config', { headers: { Authorization: `Basic ${token}` } });
-    if (!res.ok) {
-      setErr('Login failed — check username and password.');
-      return;
+    try {
+      const res = await fetch('/api/v1/config', { headers: { Authorization: `Basic ${token}` } });
+      if (!res.ok) {
+        setErr('Login failed — check username and password.');
+        return;
+      }
+      setStoredAuth(user, pass);
+      setAuthed(true);
+    } catch {
+      setErr('Cannot reach server — check that miner-server is running.');
     }
-    setStoredAuth(user, pass);
-    setAuthed(true);
   };
 
   if (!ready) {